On 2016/02/11 13:34, Todd C. Miller wrote: > On Thu, 11 Feb 2016 10:39:53 +0000, Stuart Henderson wrote: > > > I updated some firewalls to -current yesterday (from somewhere between > > 5.6 and 5.7) and am now seeing a lot of "arp: attempt to add entry" > > logged, see below. (Looks like someone has put a machine on the wrong > > vlan and it's sending out broadcast arp replies for conflict detection > > which are triggering the logs, anyway that's a different problem). > > > > Some of the lines in the logged file get split in half. I'm thinking > > this probably warrants further investigation as it could cause log > > monitoring programs to not notice certain problems.. > > That's really weird. The /dev/klog fd in syslogd isn't opened > non-blocking and from what I understand, log messages from the > kernel shouldn't be seen from userland until logwakeup() is called > at the end up the message. > > Can you try disabling kqueue in syslogd by setting EVENT_NOKQUEUE=1 > and see if the behavior changes?
It seems like it is probably happening less often, but it hasn't stopped completely.
